38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720

Sharing

Copy URL Twitter E-mail

General

Target
38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720
Size 1.5MB
Sample260910-qzjs1sthpg
SHA256 38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720
MD5 08ad6a63a4fe52d49768d4ffbf196d61
SHA1 b7e5d257ad90b95bff9551a1a659e29ed7236566
SHA512 2a5708c9a7a95d856afd3307d4af984411e66214627d81e104d9c2bd34c39f0e48665a40afe338705652f41e5c826bb9265ca8c009da6df1a59091f028d20c7f
SSDEEP 6144:UYkLWCTxDrF98Oh8P7AEL8IhoBAf3JQ8eAK:UYIW0p98Oh8P7h8Y3GsK
TLSH
T18065461032C18833D1F207B317788AD3D4EB7D234A7D6997A6B80E999DF2581B637B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720

File Explorer

38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720

.exe 1.5MB

38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720

IMPHASH 2847d22fec522c8926da88a0a3543ac1
SHA256 38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720
MD5 08ad6a63a4fe52d49768d4ffbf196d61
SHA1 b7e5d257ad90b95bff9551a1a659e29ed7236566
SHA512 2a5708c9a7a95d856afd3307d4af984411e66214627d81e104d9c2bd34c39f0e48665a40afe338705652f41e5c826bb9265ca8c009da6df1a59091f028d20c7f
SSDEEP 6144:UYkLWCTxDrF98Oh8P7AEL8IhoBAf3JQ8eAK:UYIW0p98Oh8P7h8Y3GsK
TLSH
T18065461032C18833D1F207B317788AD3D4EB7D234A7D6997A6B80E999DF2581B637B52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130117

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError CloseHandle InitializeCriticalSectionAndSpinCount WideCharToMultiByte MoveFileW DeleteFileW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW CreateFileW GetFileSize WriteFile GetComputerNameA GetModuleFileNameW CreateProcessW Sleep GetSystemTime FileTimeToLocalFileTime RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess GetModuleHandleA FindResourceExW FindResourceW LoadResource LockResource SizeofResource FileTimeToSystemTime SystemTimeToFileTime GetComputerNameW LoadLibraryW GetProcAddress ReadFile GetModuleHandleW SetEndOfFile WriteConsoleW SetStdHandle ReadConsoleW OutputDebugStringW SetFilePointer FlushFileBuffers SetFilePointerEx InterlockedIncrement InterlockedDecrement MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer GetCommandLineW GetCurrentThreadId LoadLibraryExW RtlUnwind GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW IsProcessorFeaturePresent LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW GetStdHandle GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent GetConsoleCP GetConsoleMode IsValidCodePage GetACP GetOEMCP

advapi32

CreateServiceW RegCreateKeyExW CloseServiceHandle StartServiceW ChangeServiceConfigW QueryServiceConfigW OpenServiceW OpenSCManagerW RegSetValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext CryptAcquireContextW GetUserNameW GetUserNameA FreeSid CheckTokenMembership AllocateAndInitializeSid RegQueryValueExW

ole32

CoCreateInstance CoInitialize

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW PathAddExtensionW PathRemoveExtensionW PathAppendW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

38f744a2de2995cbc47f405f38db682ec81961c90792a32ff517f1b1c4bda720

kernel32

advapi32

ole32

shell32

shlwapi

generic